fix(approval): every unattended context clears leaked presence vars

Widen the cron-only clearing to `_unattended_contexts()`: a webhook /
api_server session running inside a gateway inherits HERMES_EXEC_ASK=1
exactly like an external cron worker does, and `_presence()` returning
is_ask=True sent it to the gateway-decision branch with no notifier — a
pending card nobody can answer — instead of `approvals.unattended_mode`.
Same class as #110932, one predicate.

Test trimmed to two invariants (cron / webhook leak → cleared; interactive
keeps presence); the launch-path comment in cron/scheduler.py names the
env-fallback consumers instead of an internal incident log.

tools/approval.py

@@ -867,21 +867,18 @@ def _human_decision(spec: _GateSpec, *, command: str, description: str,
 
 
 def _presence(approval_callback=None) -> tuple:
-    """``(approval_callback, is_cli, is_gateway, is_ask)`` for the current context. Single-query
-    (-q) exports HERMES_INTERACTIVE=1 but nobody answers prompts, and HERMES_EXEC_ASK has no
-    human either — both are cleared so single_query_mode actually takes effect."""
+    """``(approval_callback, is_cli, is_gateway, is_ask)`` for the current context.
+
+    Every unattended context (single-query ``-q``, cron, programmatic platforms) clears the
+    presence trio: ``hermes chat -q`` exports HERMES_INTERACTIVE=1 for sudo prompts, a gateway
+    sets HERMES_EXEC_ASK=1 at startup and passes its environ to every external cron worker
+    (#110932), and a webhook session inherits that same HERMES_EXEC_ASK — in none of them can a
+    human answer the card, so the gate must resolve from ``approvals.<ctx>_mode`` instead of
+    parking on a pending approval."""
     approval_callback = _resolve_cli_approval_callback(approval_callback)
     is_cli, is_gateway = _is_interactive_cli(), _is_gateway_approval_context()
     is_ask = env_var_enabled("HERMES_EXEC_ASK")
-    if _is_single_query_approval_context():
-        is_cli = is_gateway = is_ask = False
-    if _is_cron_approval_context():
-        # Cron workers are unattended: nobody can answer an approval card. Presence
-        # vars (HERMES_INTERACTIVE / HERMES_EXEC_ASK) can leak in via any env-passing
-        # launch path — treat them as advisory here so the gate consults
-        # ``approvals.cron_mode`` instead of hanging on a pending card (#110932).
-        # Mirrors the single-query clearing above and the cron exclusion inside
-        # ``_is_gateway_approval_context``.
+    if _unattended_contexts():
         is_cli = is_gateway = is_ask = False
     return approval_callback, is_cli, is_gateway, is_ask